Incorrect calculation in Linux kernel - CVE-2026-98974

Vulnerability details

The vulnerability allows a local user to corrupt another file's contents by overwriting shared filesystem blocks without triggering copy-on-write.

The vulnerability exists due to incorrect file size calculations in the Linux kernel XFS exchange-range implementation when processing XFS_IOC_EXCHANGE_RANGE operations with the TO_EOF flag and nonzero offsets on a filesystem supporting reflink and exchange-range. A local user can perform a sequence of file range exchanges that leaves shared blocks beyond the reported end of a file and incorrectly clears its reflink flag, then extend that file with a write to modify blocks still shared with another file.

Affected software

How to mitigate CVE-2026-98974

External References

• https://git.kernel.org/stable/c/7dfb218c829c1acb626e0fe92c5fddb9a26a03e9
• https://git.kernel.org/stable/c/952b5c99a840c2bff1f6645fd5e06e1db6ec2623
• https://git.kernel.org/stable/c/b361d32b884f8ddcb9bad5d99b69eece648f8e43
• https://git.kernel.org/stable/c/cf32eb20dfacfd2e92ce86ba1fece9ae5f98a7d8

Related Security Bulletins

• Incorrect calculation in Linux kernel xfs
• Debian update for linux